
Gradient-based methods generate adversarial perturbations according to the gradient direction of the loss function (e.g., [1]}, [2]}, [3]}, [4]}, [5]}, [6]}). Fast Gradient Sign Method (FGSM) [1]} is the first AE attack that perturbs the inputs in a single step to achieve misclassification. Later attacks such as Basic Iterative Method (BIM) [2]}, Projected Gradient Descent (PGD) [3]}, and Jacobian-based Saliency Map Attack (JSMA) [4]} are more effective in terms of attack successful rate under a given perturbation strength constraint.

Optimization-based methods formulate AE designs as a constrained optimization problem and solve it accordingly. For example, Carlini-Wagner (CW) [11]} constructs the AEs by solving an optimization problem consisting of an L2-norm perturbation magnitude quantification term and a specific loss term. While more expensive than gradient-based AE attacks, to the best of our knowledge, it is one of the strongest AE attacks by far.


Transformation-based methods conduct spatial transformations with slight geometric perturbations (e.g., Spatially Transformed Attack [12]}) or train a generative model for AE transformation (e.g., Adversarial Transformation Networks (ATN) [13]}).


